Magic/tragic email links: don't make them the only option

Re:Magic/tragic email links: don't make them the only option by codetrotter on Tuesday January 07, 2025 @09:18PM (#42630190)

That’s why you combine it with a check for source IP and tell your user that they need to approve from a device that has same IP as the one they are logging in on. So if I’m logging in on my laptop, and approving with my phone, it will be rejected if my phone is using mobile data while my laptop is using landline, but will approve if my phone is connected to WiFi of the same network my laptop is connected to, or if my laptop is tethered via my phone, because then I have same external source IP on both devices.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by witrak on Tuesday January 07, 2025 @10:55PM (#42630736)

This scenario is a solution only in simplest cases. It doesn't work when someone routinely uses a VPN on the phone (when often uses free public wi-fi in airports, railway stations, markets etc) because of possible MITM attacks.

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by asddubs on Wednesday January 08, 2025 @12:38AM (#42631296)

also some ISPs will give you a different IP every request

[ Parent | on HN ]

Re:Magic/tragic email links: don't make them the only option by apitman on Wednesday January 08, 2025 @01:29AM (#42631591)

This has security and usability issues. NAT/CGNAT means a potentially large number of people can hijack your login.

[ Parent | on HN ]